WordPress Security Scan and Plugin Vulnerability Check
Check your WordPress site from the outside, the way bots do. See plugins and themes with known vulnerabilities, files that shouldn't be public, and settings that make attacks easier.
Next you confirm you own the site and add your work email. Open the full scan form.
- Passive & read-only
- No logins, no form posts
- Never downloads your config files
- Results in about a minute
Most WordPress break-ins don't start with WordPress itself. They start with a plugin that missed an update, a forgotten backup file or a log left in a public folder. The Pro Logica WordPress security scan reads what your site already shows the public: page code, plugin and theme files, and a short list of well-known paths. It tells you what an attacker's bot would notice first. It's passive and read-only, and it takes about a minute.
Why plugins are the WordPress risk to watch
of all websites run WordPress, and 58.3% of sites whose content system is known.
Source: W3Techs, Oct 20, 2026
of 11,334 new WordPress-ecosystem vulnerabilities in 2025 were in plugins, 9% in themes, and only 6 low-priority issues in core.
of 424 WordPress sites in a passive scan ran at least one plugin with a known vulnerability.
Source: GuardingWP, May 2026
Wordfence's report on 2024 found the same pattern: 96% of disclosed WordPress vulnerabilities affected plugins (Wordfence, Apr 2025). WordPress core is well maintained and updates itself. Plugins are where sites fall behind.
What the WordPress security scan checks
Plugins with known vulnerabilities
We read plugin names and versions from your public pages and plugin readme files, then match them against published vulnerability records. Each match lists the CVE, its severity score and the version that fixes it.
Theme and core versions
The same match for your active theme and your WordPress version, plus a flag when your pages announce the version number.
Closed or outdated plugins
Plugins that WordPress.org has closed, which means no more directory updates, and plugins behind their latest release.
Config backups left online
Copies like wp-config.php.bak usually hold your database password. We only check whether the file exists. We never download it.
Public debug logs and folder listings
An exposed debug.log, or an uploads folder that lists every file.
Unfinished installer
A reachable install.php that hasn't been completed lets anyone take over the site.
Username leaks
Usernames listed by the REST API (/wp-json/wp/v2/users) or revealed by ?author= links.
xmlrpc.php enabled
The old remote-publishing endpoint that bots use for password guessing. We check whether it answers. We never send it anything.
Server basics
HTTPS, certificate health, security headers, exposed .env or Git files, and an outdated PHP version announced in headers.
The full report gives every finding with evidence, why it matters, numbered fix steps and a copy-paste prompt you can give an AI assistant. Version findings carry a confidence label (High, Likely or Possible), because we read versions from public files. Always confirm the installed version in wp-admin before acting.
What an outside scan can't see
We'd rather tell you now than have you assume. A passive scan from outside your server cannot:
- find malware, injected spam or backdoors in your files or database (this is not a malware scan)
- see plugins that don't load anything on your homepage
- check admin accounts, passwords, two-factor login or file permissions
- tell whether a vulnerable plugin is actually exploitable with your settings or firewall
If a firewall or CDN blocks some requests, the report lists those checks as "not checked" instead of guessing.
Sample report
| CVE | CVSS | Fixed in |
|---|---|---|
| CVE-2020-35489 | 10 | 5.3.2 |
| CVE-2023-6449 | 7.2 | 5.8.4 |
| CVE-2024-2242 | 6.1 | 5.9.2 |
| + 3 more in the full report | ||
From free scan to ongoing monitoring
- Free scan. Enter your URL and get a 0–100 score and your top finding in about a minute. Run free WordPress scan
- Unlock full report. Every finding with evidence, the vulnerability table with CVE links, numbered fixes, AI fix prompts and a PDF.
- App Guard early access. New plugin vulnerabilities are published every day. App Guard re-checks your site and alerts you when something you run becomes affected. Join App Guard early access
Questions people ask
Is the WordPress security scan safe to run on my site?
Yes. It sends a small number of ordinary page requests (about 40 at most), spaced out, to the site you confirm you own or are allowed to test. It never logs in, never submits forms, never sends anything to xmlrpc.php and never downloads configuration backups.
Is this a malware scan?
No. Finding malware needs access to your server files and database. Our scan shows what your site exposes publicly and which plugins have known vulnerabilities, so you can close the doors attackers use most.
How do you know which plugins I run?
From your public pages. Plugin files load from paths like /wp-content/plugins/plugin-name/, and many plugins publish a readme file with a version. Plugins that load nothing publicly can't be seen, so check wp-admin too.
Where does the vulnerability data come from?
From WPVulnerability, a public vulnerability database for WordPress core, plugins and themes released under a CC0 public-domain license. Each match links to its CVE record so you can verify it.
Should I disable xmlrpc.php?
Usually, yes, unless you use Jetpack, the WordPress mobile app or another remote publishing tool that needs it. Our guide below shows how to check and block it safely.
How often should I scan?
After every plugin or theme install, and at least monthly, because new plugin vulnerabilities are published every day. App Guard early access automates the re-checks.
Methods and limits
- Owner-only and passive. We scan only the domain you enter and confirm you're authorized to test, plus its
wwwversion. - Read-only requests. Page and file requests only, with no form posts, no logins and no password guesses. Possible config backups are checked by status only and never downloaded.
- Capped. About 40 requests, a 45-second limit and spacing between requests. Usernames are shown masked.
- Vulnerability data: WPVulnerability (CC0), matched on detected versions. Matches carry a confidence label. Confirm in wp-admin.
- Not a penetration test and not a malware scan.
Related guides
- AI App Security Check
- How to disable xmlrpc.php in WordPress
- Fix WordPress user enumeration
- Exposed .env file
- Missing security headers
By Pro Logica Security Research · Last reviewed Oct 20, 2026